d0afe8a488e6f60cd7b1a862f319215f7d65b7964e00bd3bf02132b81d2e5d48 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 01:23

Sharing

Report Analysis Logs

General

Target

disallowable/leggings.cmd
Size

353B
MD5

549134ecfe26a6eca256736cf8545a87
SHA1

c6622eb02462ae0b2a99721854bd46c5fb8f680f
SHA256

69d7d7ec242efb6b5a92d67ae900ce8b6234433dc1536065c4fffae5e6205015
SHA512

2e8f72efffbe2e489158a922f15beec35c8e76700713e564df9a0acde7d7e75d6eb349d37c7d7e081fd163577003fab4ad82e6f6d7bef6e9850716eed054c91f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1756	1808	cmd.exe	28
PID 1808 wrote to memory of 1756	1808	cmd.exe	28
PID 1808 wrote to memory of 1756	1808	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\disallowable\leggings.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\replace.exe
  replace C:\Windows\system32\regsv C:\Users\Admin\AppData\Local\Temp /A
  2⤵
  PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads